Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- '13#.#1.58.32':445
- '13#.#1.153.172':445
- '13#.#1.139.215':445
- '13#.#1.246.38':445
- '13#.#1.207.198':445
- '13#.#1.85.216':445
- '13#.#1.192.127':445
- '13#.#1.250.199':445
- '13#.#1.48.96':139
- '13#.41.0.92':139
- '13#.#1.146.162':139
- '13#.#1.62.78':139
- '13#.#1.100.47':445
- '13#.#1.47.126':445
- '13#.#1.25.41':445
- '13#.#1.42.134':445
- '13#.#1.139.99':445
- '13#.#1.64.22':445
- '13#.#1.102.71':445
- '13#.#1.88.220':445
- '13#.#1.147.128':445
- '13#.#1.88.202':445
- '13#.#1.85.229':445
- '13#.#1.65.231':445
- '13#.41.3.61':445
- '13#.#1.20.137':445
- '13#.#1.255.25':445
- '13#.#1.112.148':445
- '13#.#1.110.96':445
- '13#.#1.24.83':445
- '13#.#1.147.146':139
- '13#.#1.193.111':139
- '13#.#1.111.69':139
- '13#.#1.46.253':139
- '13#.#1.43.37':139
- '13#.#1.239.15':139
- '13#.#1.68.25':139
- '13#.#1.65.182':139
- '13#.#1.243.16':139
- '13#.#1.94.80':139
- '13#.#1.108.42':139
- '13#.#1.195.37':139
- '13#.#1.79.170':139
- '13#.#1.75.235':139
- '13#.#1.201.75':139
- '13#.#1.4.107':139
- '13#.#1.241.92':139
- '13#.#1.181.25':139
- '13#.#1.88.215':139
- '13#.#1.116.205':139
- '13#.#1.43.174':445
- '13#.#1.122.177':139
- '13#.#1.74.70':139
- '13#.#1.215.253':139
- '13#.#1.159.143':139
- '13#.#1.152.170':139
- '13#.#1.249.148':139
- '13#.#1.12.125':139
- '13#.#1.46.65':139
- '13#.#1.177.253':139
- '13#.#1.124.164':139
- '13#.#1.64.22':139
- '13#.#1.85.229':139
- '13#.#1.255.25':139
- '13#.#1.139.99':139
- '13#.#1.102.71':139
- '13#.#1.236.154':139
- '13#.#1.42.134':139
- '13#.#1.20.137':139
- '13#.#1.85.216':139
- '13#.#1.112.148':139
- '13#.#1.110.96':139
- '13#.41.94.7':139
- '13#.#1.58.32':139
- '13#.#1.24.83':139
- '13#.#1.65.231':139
- '13#.#1.88.167':139
- '13#.#1.134.27':139
- '13#.#1.25.227':139
- '13#.#1.233.13':139
- '13#.#1.20.120':139
- '13#.#1.178.29':139
- '13#.#1.100.165':139
- '13#.#1.232.6':139
- '13#.#1.32.125':139
- '13#.#1.88.202':139
- '13#.#1.88.220':139
- '13#.#1.147.128':139
- '13#.#1.13.27':139
- '13#.#1.69.42':139
- '13#.#1.129.17':139
- '13#.41.3.61':139
- '13#.#1.213.67':445
- '13#.#1.88.167':445
- '13#.#1.233.13':445
- '13#.#1.52.148':445
- '13#.#1.43.174':139
- '13#.#1.200.202':445
- '13#.#1.20.120':445
- '13#.#1.13.27':445
- '13#.#1.25.227':445
- '13#.#1.100.165':445
- '13#.#1.32.125':445
- '13#.#1.178.29':445
- '13#.#1.129.17':445
- '13#.#1.69.42':445
- '13#.#1.232.6':445
- '13#.#1.250.199':139
- '13#.#1.139.215':139
- '13#.#1.153.172':139
- '13#.41.26.8':139
- '13#.#1.207.198':139
- '13#.#1.192.127':139
- '13#.#1.246.38':139
- '13#.#1.25.41':139
- '13#.#1.188.192':445
- '13#.#1.8.138':445
- '13#.#1.58.188':445
- '13#.#1.23.23':445
- '13#.#1.47.126':139
- '13#.#1.100.47':139
- '13#.#1.38.106':445
- '13#.#1.108.83':445
- '13#.#1.114.131':139
- '13#.#1.3.171':139
- '13#.#1.64.74':139
- '13#.#1.108.83':139
- '13#.#1.139.175':139
- '13#.#1.11.51':139
- '13#.#1.7.226':139
- '13#.41.9.10':139
- '13#.#1.201.151':139
- '13#.#1.16.117':139
- '13#.#1.76.239':139
- '13#.#1.81.18':139
- '13#.#1.77.168':139
- '13#.#1.107.46':139
- '13#.#1.196.157':445
- '13#.#1.72.182':139
- '13#.#1.72.182':445
- '13#.#1.208.95':445
- '13#.#1.18.165':445
- '13#.#1.61.31':445
- '13#.#1.184.60':445
- '13#.#1.96.107':139
- '13#.41.77.7':139
- '13#.#1.107.209':139
- '13#.#1.229.229':139
- '13#.#1.165.136':139
- '13#.#1.110.119':139
- '13#.#1.38.98':139
- '13#.#1.4.217':139
- '13#.#1.53.134':139
- '13#.#1.33.70':139
- '13#.#1.75.166':139
- '13#.#1.111.234':139
- '13#.#1.164.148':139
- '13#.#1.12.202':139
- '13#.#1.7.148':139
- '13#.#1.207.128':139
- '13#.#1.75.84':139
- '13#.#1.115.221':139
- '13#.#1.37.93':139
- '13#.#1.82.100':139
- '13#.#1.148.225':139
- '13#.#1.15.238':139
- '13#.#1.183.116':139
- '13#.#1.183.116':445
- '13#.#1.17.72':139
- '13#.#1.139.122':139
- '13#.#1.80.231':139
- '13#.#1.5.250':139
- '13#.#1.156.124':139
- '13#.#1.10.67':139
- '13#.41.59.6':139
- '13#.#1.5.232':139
- '13#.#1.31.137':139
- '13#.#1.185.31':139
- '13#.#1.240.116':139
- '13#.#1.52.169':139
- '13#.#1.188.54':139
- '13#.#1.188.54':445
- '13#.#1.43.211':139
- '13#.#1.116.205':445
- '13#.#1.146.162':445
- '13#.#1.147.146':445
- '13#.41.0.92':445
- '13#.#1.196.157':139
- '13#.#1.241.92':445
- '13#.#1.122.177':445
- '13#.#1.181.25':445
- '13#.#1.215.253':445
- '13#.#1.46.65':445
- '13#.#1.177.253':445
- '13#.#1.62.78':445
- '13#.#1.74.70':445
- '13#.#1.48.96':445
- '13#.#1.88.215':445
- '13#.#1.208.95':139
- '13#.#1.6.211':139
- '13#.#1.18.165':139
- '13#.#1.184.60':139
- '13#.#1.29.166':139
- '13#.#1.62.195':139
- '13#.#1.77.190':139
- '13#.#1.145.85':139
- '13#.#1.58.134':139
- '13#.#1.61.31':139
- '13#.#1.143.97':139
- '13#.#1.134.75':139
- '13#.#1.239.55':139
- '13#.#1.215.80':139
- '13#.#1.75.65':139
- '13#.#1.124.164':445
- '13#.#1.29.166':445
- '13#.#1.62.195':445
- '13#.#1.77.190':445
- '13#.#1.195.37':445
- '13#.#1.4.107':445
- '13#.#1.94.80':445
- '13#.#1.108.42':445
- '13#.#1.58.134':445
- '13#.#1.134.75':445
- '13#.#1.6.211':445
- '13#.#1.145.85':445
- '13#.#1.143.97':445
- '13#.#1.215.80':445
- '13#.#1.75.65':445
- '13#.#1.239.55':445
- '13#.#1.239.15':445
- '13#.#1.43.37':445
- '13#.#1.68.25':445
- '13#.#1.152.170':445
- '13#.#1.12.125':445
- '13#.#1.159.143':445
- '13#.#1.249.148':445
- '13#.#1.65.182':445
- '13#.#1.75.235':445
- '13#.#1.201.75':445
- '13#.#1.79.170':445
- '13#.#1.243.16':445
- '13#.#1.193.111':445
- '13#.#1.111.69':445
- '13#.#1.46.253':445
- '13#.#1.213.67':139
- '13#.#1.36.246':445
- '13#.#1.68.177':445
- '13#.#1.133.130':445
- '13#.#1.4.252':445
- '13#.#1.51.93':445
- '13#.#1.25.96':445
- '13#.#1.151.22':445
- '13#.#1.68.252':445
- '13#.#1.103.28':445
- '13#.#1.167.102':445
- '13#.#1.204.166':445
- '13#.#1.28.181':445
- '13#.#1.65.86':445
- '13#.#1.44.174':445
- '13#.#1.44.78':445
- '13#.#1.112.191':445
- '13#.#1.220.234':445
- '13#.#1.121.220':445
- '13#.#1.133.104':445
- '13#.#1.137.54':445
- '13#.41.5.72':445
- '13#.#1.133.161':445
- '13#.#1.247.121':445
- '13#.#1.216.3':445
- '13#.#1.110.137':445
- '13#.#1.220.109':445
- '13#.#1.64.67':445
- '13#.#1.233.247':445
- '13#.#1.13.123':445
- '13#.#1.204.66':445
- '13#.#1.167.36':445
- '13#.#1.33.166':9988
- '13#.#1.204.66':9988
- '13#.#1.110.137':9988
- '13#.#1.155.85':9988
- '13#.#1.217.208':9988
- '13#.#1.36.246':9988
- '13#.#1.133.161':9988
- '13#.#1.121.170':9988
- '13#.#1.204.166':9988
- '13#.#1.204.120':9988
- '13#.#1.10.174':9988
- '13#.#1.68.252':9988
- '13#.#1.239.211':9988
- '13#.#1.167.36':9988
- '13#.#1.105.194':9988
- '13#.#1.152.88':445
- '13#.#1.142.135':445
- '13#.#1.155.85':445
- '13#.#1.10.174':445
- '13#.#1.121.170':445
- '13#.#1.204.120':445
- '13#.#1.16.62':445
- '13#.#1.44.234':445
- '13#.#1.167.102':9988
- '13#.#1.142.135':9988
- '13#.#1.65.86':9988
- '13#.#1.151.22':9988
- '13#.#1.105.194':445
- '13#.#1.123.76':445
- '13#.#1.23.240':9988
- '13#.#1.13.123':139
- '13#.#1.204.66':139
- '13#.#1.64.67':139
- '13#.#1.233.247':139
- '13#.#1.220.234':139
- '13#.#1.121.220':139
- '13#.#1.247.121':139
- '13#.#1.216.3':139
- '13#.#1.151.22':139
- '13#.#1.4.252':139
- '13#.#1.36.246':139
- '13#.#1.25.96':139
- '13#.#1.110.137':139
- '13#.#1.220.109':139
- '13#.#1.51.93':139
- '13#.#1.93.217':139
- '13#.#1.179.156':139
- '13#.#1.33.166':139
- '13#.#1.217.208':139
- '13#.#1.235.30':139
- '13#.#1.147.235':139
- '13#.#1.192.112':139
- '13#.#1.211.130':139
- '13#.#1.133.161':139
- '13#.#1.133.104':139
- '13#.#1.112.191':139
- '13#.41.5.72':139
- '13#.#1.239.211':139
- '13#.#1.23.240':139
- '13#.#1.137.54':139
- '13#.#1.68.177':139
- '13#.#1.123.76':139
- '13#.#1.217.208':445
- '13#.#1.235.30':445
- '13#.#1.105.194':139
- '13#.#1.142.135':139
- '13#.#1.155.85':139
- '13#.#1.44.234':139
- '13#.#1.147.235':445
- '13#.#1.211.130':445
- '13#.#1.239.211':445
- '13#.#1.23.240':445
- '13#.#1.33.166':445
- '13#.#1.192.112':445
- '13#.#1.93.217':445
- '13#.#1.179.156':445
- '13#.#1.44.78':139
- '13#.#1.28.181':139
- '13#.#1.103.28':139
- '13#.#1.44.174':139
- '13#.#1.133.130':139
- '13#.#1.68.252':139
- '13#.#1.65.86':139
- '13#.#1.167.102':139
- '13#.#1.16.62':139
- '13#.#1.10.174':139
- '13#.#1.152.88':139
- '13#.#1.204.120':139
- '13#.#1.204.166':139
- '13#.#1.167.36':139
- '13#.#1.121.170':139
- '13#.#1.54.66':445
- '13#.#1.117.91':445
- '13#.#1.162.31':445
- '13#.#1.223.55':445
- '13#.#1.61.144':445
- '13#.#1.132.25':445
- '13#.#1.25.61':445
- '13#.#1.128.22':445
- '13#.#1.89.136':445
- '13#.#1.12.116':445
- '13#.#1.160.132':445
- '13#.#1.36.172':445
- '13#.#1.9.111':445
- '13#.#1.77.128':445
- '13#.#1.135.168':445
- '13#.#1.61.167':445
- '13#.41.0.94':445
- '13#.#1.230.27':445
- '13#.41.5.8':445
- '13#.#1.31.191':139
- '13#.#1.214.253':445
- '13#.#1.21.100':445
- '13#.#1.150.221':445
- '13#.#1.70.178':445
- '13#.#1.183.203':445
- '13#.#1.169.54':445
- '13#.#1.24.20':445
- '13#.#1.118.248':445
- '13#.#1.32.194':445
- '13#.#1.233.32':445
- '13#.#1.244.204':445
- '13#.#1.144.164':445
- '13#.#1.31.191':445
- '13#.#1.38.106':139
- '13#.#1.157.49':445
- '13#.#1.6.141':445
- '13#.#1.99.125':445
- '13#.#1.180.166':139
- '13#.#1.180.166':445
- '13#.#1.200.202':139
- '13#.#1.156.127':139
- '13#.#1.52.148':139
- '13#.#1.58.188':139
- '13#.#1.23.23':139
- '13#.#1.8.138':139
- '13#.#1.188.192':139
- '13#.#1.234.59':445
- '13#.#1.30.102':445
- '13#.#1.215.20':445
- '13#.41.8.29':445
- '13#.#1.187.90':445
- '13#.#1.107.245':445
- '13#.#1.225.48':445
- '13#.#1.96.162':445
- '13#.#1.104.141':445
- '13#.#1.116.2':445
- '13#.#1.67.248':445
- '13#.#1.145.251':445
- '13#.#1.13.32':445
- '13#.#1.54.44':445
- '13#.#1.154.37':445
- '13#.#1.32.194':139
- '13#.#1.233.32':139
- '13#.#1.1.233':445
- '13#.#1.118.248':139
- '13#.#1.61.167':139
- '13#.#1.230.27':139
- '13#.#1.150.221':139
- '13#.#1.24.20':139
- '13#.#1.132.25':139
- '13#.#1.25.61':139
- '13#.#1.54.66':139
- '13#.#1.61.144':139
- '13#.#1.70.178':139
- '13#.#1.169.54':139
- '13#.#1.162.31':139
- '13#.#1.28.181':9988
- '13#.#1.51.93':9988
- '13#.#1.233.247':9988
- '13#.#1.16.62':9988
- '13#.#1.13.123':9988
- '13#.#1.147.235':9988
- '13#.#1.44.174':9988
- '13#.#1.133.130':9988
- '13#.#1.21.100':139
- '13#.41.5.8':139
- '13#.41.0.94':139
- '13#.#1.214.253':139
- '13#.#1.4.252':9988
- '13#.#1.192.112':9988
- '13#.#1.64.67':9988
- '13#.#1.117.91':139
- '13#.#1.13.32':139
- '13#.#1.54.44':139
- '13#.#1.154.37':139
- '13#.#1.96.162':139
- '13#.#1.234.59':139
- '13#.#1.30.102':139
- '13#.#1.215.20':139
- '13#.#1.145.251':139
- '13#.#1.157.49':139
- '13#.#1.99.125':139
- '13#.#1.144.164':139
- '13#.#1.6.141':139
- '13#.#1.104.141':139
- '13#.#1.116.2':139
- '13#.#1.67.248':139
- '13#.#1.77.128':139
- '13#.#1.160.132':139
- '13#.#1.135.168':139
- '13#.#1.9.111':139
- '13#.#1.183.203':139
- '13#.#1.223.55':139
- '13#.#1.128.22':139
- '13#.#1.36.172':139
- '13#.#1.107.245':139
- '13#.#1.225.48':139
- '13#.41.8.29':139
- '13#.#1.244.204':139
- '13#.#1.89.136':139
- '13#.#1.12.116':139
- '13#.#1.187.90':139